<div dir="auto">Use a <() process substitution construct to feed the patterns from an external file.<br><br><div data-smartmail="gmail_signature">--<br>finger painting on glass is an inexact art - apologies for any errors in this scra^Hibble<br><br>()/)/)() ..ASCII for Onno..</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, 12 Mar 2022, 09:47 Brad Campbell, <<a href="mailto:brad@fnarfbargle.com">brad@fnarfbargle.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">G'day all,<br>
<br>
I've knocked up a simple log processor in bash to dump ip addresses that access our zimbra server on a daily basis.<br>
<br>
It's not pretty but it works :<br>
<br>
LIST=`zcat $LOGNOW | \<br>
grep -o 'oip=[^;]*' | \<br>
sed 's/oip=//g' | \<br>
sort | \<br>
uniq | \<br>
egrep -v '(^192.168.|^10.8.)' `<br>
<br>
At the moment it gives me a list like :<br>
1.126.106.244<br>
1.126.109.132<br>
1.146.128.86<br>
1.146.135.178<br>
1.146.167.203<br>
1.146.169.253<br>
1.146.174.225<br>
1.146.175.139<br>
<br>
That is yesterdays list and are all Telstra mobile CGNAT addresses. I'd like to be able to filter those based on the known telstra subnets and just leave the outliers (like the continuous stream of Russian bots hitting the EWS port scanning for Exchange vulnerabilities)<br>
<br>
What I'd like to be able to do is replace the final egrep with something that can handle subnets (and a list of them), for example : <a href="http://1.128.0.0/11" rel="noreferrer noreferrer" target="_blank">1.128.0.0/11</a>, <a href="http://1.120.0.0/13" rel="noreferrer noreferrer" target="_blank">1.120.0.0/13</a>, <a href="http://192.168.0.0/16" rel="noreferrer noreferrer" target="_blank">192.168.0.0/16</a>, <a href="http://10.0.0.0/8" rel="noreferrer noreferrer" target="_blank">10.0.0.0/8</a><br>
<br>
Before I converted the whole thing to python and implemented subnet filtering I thought I'd ask and see if anyone has something clever they've used/seen.<br>
<br>
Regards,<br>
Brad<br>
_______________________________________________<br>
PLUG discussion list: <a href="mailto:plug@plug.org.au" target="_blank" rel="noreferrer">plug@plug.org.au</a><br>
<a href="http://lists.plug.org.au/mailman/listinfo/plug" rel="noreferrer noreferrer" target="_blank">http://lists.plug.org.au/mailman/listinfo/plug</a><br>
Committee e-mail: <a href="mailto:committee@plug.org.au" target="_blank" rel="noreferrer">committee@plug.org.au</a><br>
PLUG Membership: <a href="http://www.plug.org.au/membership" rel="noreferrer noreferrer" target="_blank">http://www.plug.org.au/membership</a><br>
</blockquote></div>